         private-key  (utils/get-private-key keypair)
         x500-name    (utils/cn master-certname)
         ca-x500-name (utils/cn ca-name)
-        [not-before
-         not-after]  (cert-validity-dates ca-ttl)
+        validity     (cert-validity-dates ca-ttl)
         hostcert     (utils/sign-certificate ca-x500-name ca-private-key
                                              (next-serial-number! serial-file)
-                                             not-before
-                                             not-after
+                                             (:not-before validity)
+                                             (:not-after validity)
                                              x500-name public-key
                                              extensions)]
     (write-cert-to-inventory! hostcert inventory-file)

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;; Internal

(schema/defn cert-validity-dates :- [Date]
  "Calculate the not-before & not-after dates that define a certificate's
   period of validity. The value of `ca-ttl` is expected to be in seconds,
   and the dates will be based on the current time. Returns a list of dates
   in the format: [not-before not-after]"
  [ca-ttl :- schema/Int]
  (let [now        (time/now)
        not-before (time/minus now (time/days 1))
        not-after  (time/plus now (time/secs ca-ttl))]
    [(.toDate not-before) (.toDate not-after)]))

(schema/defn settings->cadir-paths
  "Trim down the CA settings to include only paths to files and directories.

  "Settings from Puppet that are necessary for CA initialization
   and request handling during normal Puppet operation.
   Most of these are Puppet configuration settings."
  {:autosign              (schema/either schema/Str schema/Bool)
   :allow-duplicate-certs schema/Bool
   :cacert                schema/Str
   :cacrl                 schema/Str
   :cakey                 schema/Str
